> ## Documentation Index > Fetch the complete documentation index at: https://docs.voxworks.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create web session > Mint a single-use session for a browser call placed from a page you host. Returns a short-lived token plus the SIP bootstrap the browser needs to reach the Voxworks media edge directly; audio never passes through this API. The session fixes the script, contact and destination at mint time. A page holding the token cannot point it at a different script, and cannot start a second call with it. The `429` on this endpoint is your team's concurrent-call ceiling, which web calls share with phone calls — distinct from the per-key rate limit, which also returns `429`. ## OpenAPI ````yaml /openapi.yaml post /api/v1/create-web-session openapi: 3.1.0 info: title: Voxworks API version: 1.0.0 description: >- Public REST API for creating contacts, scheduling calls, retrieving call results, managing lists and objects, and receiving automation webhooks. servers: - url: https://api.voxworks.ai description: Production security: - BearerAuth: [] tags: - name: Health - name: Contacts - name: Calls - name: Lists - name: Objects - name: Webhooks paths: /api/v1/create-web-session: post: tags: - Calls summary: Create web session description: > Mint a single-use session for a browser call placed from a page you host. Returns a short-lived token plus the SIP bootstrap the browser needs to reach the Voxworks media edge directly; audio never passes through this API. The session fixes the script, contact and destination at mint time. A page holding the token cannot point it at a different script, and cannot start a second call with it. The `429` on this endpoint is your team's concurrent-call ceiling, which web calls share with phone calls — distinct from the per-key rate limit, which also returns `429`. operationId: createWebSession requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateWebSessionRequest' example: script_id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 participant_identity: visitor-4821 responses: '201': description: Session minted. content: application/json: schema: $ref: '#/components/schemas/CreateWebSessionResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': description: >- The script or contact was not found, or does not belong to your team. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false message: script_id not found or does not belong to your team '429': description: >- Your team is at its concurrent-call limit, or the API key hit its rate limit. content: application/json: schema: $ref: '#/components/schemas/ConcurrencyLimitResponse' example: success: false message: Team is at its concurrent call limit of 10 max_concurrent: 10 '500': $ref: '#/components/responses/InternalServerError' components: schemas: CreateWebSessionRequest: type: object required: - script_id properties: script_id: type: string description: The script the call runs. Must belong to your team. contact_id: type: string description: >- Attach the call to a known contact. Omit to use your team's shared web contact. did: type: string description: >- One of your team's numbers, used as the AI-side number identity on the call record. Omit for a browser-only call. participant_identity: type: string description: A label for the visitor, carried through to the transcript. objects: type: object additionalProperties: type: object additionalProperties: true description: Object data keyed by object type name, linked to the contact. CreateWebSessionResponse: type: object required: - success - session_id - session_token - expires_at - ws_url - sip_domain - sip_username - sip_password - target - headers properties: success: type: boolean example: true session_id: type: string description: >- Identifies this session. No call exists yet — the call is created when the visitor connects. session_token: type: string description: >- Single-use token authorising this one call. Pass it to the browser client; it is already included in `headers`. expires_at: type: string format: date-time description: >- When the token stops being redeemable. Roughly two minutes after minting. script_id: type: string contact_id: type: string did: type: string nullable: true max_concurrent: type: integer description: >- Your team's concurrent-call ceiling, shared between web and phone calls. ws_url: type: string description: >- Secure WebSocket URL to connect to. Read it from the response on every call rather than hardcoding it. example: wss://MEDIA_EDGE_HOST sip_domain: type: string sip_username: type: string sip_password: type: string description: >- Connection bootstrap, not a credential. It grants no access on its own — the session token is what authorises the call. target: type: string description: SIP URI the browser dials. example: sip:web@MEDIA_EDGE_HOST headers: type: object additionalProperties: type: string description: >- Call metadata to forward verbatim. Pass through unchanged; do not construct these yourself. ErrorResponse: type: object required: - success - message properties: success: type: boolean example: false message: type: string ConcurrencyLimitResponse: type: object required: - success - message properties: success: type: boolean example: false message: type: string max_concurrent: type: integer description: Present when the limit reached was the concurrent-call ceiling. responses: BadRequest: description: Missing or invalid request data. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing, malformed, or invalid authorization. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid: value: success: false message: Invalid API key InternalServerError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false message: Internal server error securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: API key description: 'API key from Voxworks, sent as `Authorization: Bearer YOUR_API_KEY`.' ````